Production security

Server secrets

Store server-to-server tokens and webhook secrets in a secret manager, not in the repository or Docker image. Rotate credentials according to the LuxPay agreement and use the narrowest available scope. Never print Authorization or X-Signature values in logs.

HTTPS and verification

Reject plain HTTP and verify the server certificate and hostname. Do not disable TLS verification in sandbox. Configure connect and read timeouts, response-size limits, and protection against redirects to unexpected hosts for sensitive operations.

Request protection

Use separate request IDs and idempotency keys. Validate content type and JSON size, reject negative amounts and unprovisioned currencies, and do not send business_id to operations that derive it from authentication.

Data protection

Do not place card numbers or identity documents in metadata or descriptions. Minimize personal data, encrypt what must be retained, and define retention periods. Use technical identifiers instead of phone or email in monitoring.

Production gate

Test 401, 403, 409, 422, and 429, a connection loss after request transmission, duplicate webhook delivery, provider failure, partial refund, and expired hold. Monitor error rate, latency, duplicate detection, and reconciliation differences. Fail closed when authorization for a financial operation cannot be proven.

End-user applications

Never give a mobile app an administrative credential or a token spanning multiple businesses. Restricted operations such as freeze, reversal, approval, and execution should pass through a backend with appropriate human authorization.